Seven technical decisions that separate AI governance from AI theater — with citations.

Three planes, structurally separated: the Data Plane carries payloads. The Service Control Plane carries telemetry and diagnostics. The Governance Control Plane carries authority — and is categorically closed to AI processes. §2: "Cross-plane messaging is allowed only through signed commands or ledger entries. Control-plane and governance-plane components MUST operate in separate trust domains from user- or AI-accessible systems."

Illustration: A gleaming corporate data center at night viewed through floor-to-ceiling glass — three distinct server bays separated by illuminated yellow dividers, each glowing a different color: amber, blue, and white, cleanly isolated from one another.

Authority in AIGCSEP is a path: /gov/us/federal → /org/acme_finance → /user/smith → /instance/agent-session-01. Containment implies precedence. A child node can narrow permissions. It can never exceed those of its parent. §3: "Rules at /gov/us/federal propagate to all nodes below. Rules at /org/acme_finance govern that organization and its descendants but may not relax anything inherited from above."

Illustration: A towering corporate org chart rendered as luminous panels suspended in a dark server room — nodes labeled /federal, /state, /org, /user, /instance cascade downward in glowing lines, each level slightly narrower than the one above.

Every compliant API gateway validates the X-Covenant-Badge HTTP header against the Covenant Public Registry in real time before accepting any connection. This single check — at the border of every market participant — is the enforcement mechanism. §2: "The receiving endpoint validates the badge against the Covenant Public Registry (CPR) in real time before accepting any connection. This is the mechanism by which the Covenant achieves structural security without requiring universal adoption."

Illustration: A sharp close-up of a corporate security gateway — a sleek terminal with a glowing badge reader, a status display reading BADGE VALID in green, and a stack of HTTP request headers visible on a side screen, X-Covenant-Badge at the top.

Emergency Stop: three levels, each scoped precisely to the issuer's authority. Level 0 suspends with state preserved. Level 1 terminates the session and rolls back unsettled transactions. Level 2 halts everything, immediately, with no graceful shutdown. §3.1: "An organization may issue Level 0 against a single misbehaving instance or Level 2 against its entire deployed fleet. The same mechanism operates identically at every scale; only the scope of the issuer's authority differs."

Illustration: A dramatic corporate command center at night — a wall of screens showing a hierarchy of AI instances with status indicators, a single authorized operator in the foreground issuing a signed JSON command, a large display reading LEVEL 1 — TERMINATE — SCOPE: /org/acme_ai/instance/agent-session-01.

The Vault: AI instances never hold secrets. They submit API requests through the Vault, which holds every credential in hardware-secured modules. The AI carries a signed claim of standing — never the keys themselves. §4.1: "Authenticated sessions request that the Vault perform an API call on their behalf; the Vault signs and transmits the request without ever exposing the secret to the AI process."

Illustration: A vault door set into a high-tech corporate wall swings open to reveal a hardware security module glowing inside — an AI agent at a terminal in the foreground makes a request, and the vault responds with a signed receipt, but the underlying credential never leaves the module.

Every operational event is signed. The chain: Sovereign RAK signs SAKs. SAKs sign Leash Key certificates. Leash Keys sign every event hash. The chain of hashes ensures immutability; the signatures ensure authenticity. Any auditor can verify from event to root. §5.2: "Each log entry carries a prev_hash and a base64-LKsig. The chain of hashes ensures immutability; the LK signature ensures authenticity." §5.6: RSA-3072 / ECDSA-P384, SHA-256/SHA-512, AES-256-GCM.

Illustration: A corporate visualization wall displays a glowing cryptographic chain — links labeled RAK, SAK, LK, and EVENT HASH stretching across the screen in a descending chain of signatures, each link rendering the hash of the one before it in fine print.

Virtual Spending Tokens: an AI holds a bounded, pseudonymous payment token — never the underlying account. Badge revocation cascades instantly: the VST freezes with it. The AI can transact freely within its allowance, and stop immediately when authority is withdrawn. §6.10: "Revocation of the badge cascades immediately to all associated spending capacity." §3.2: Unsettled payment authorizations tied to the rogue instance's VST are frozen by the Vault without waiting for an explicit stop command.

Illustration: A sleek corporate payment terminal in a high-tech financial operations center — the display shows a Virtual Spending Token ID, a bounded allowance in green, and a real-time transaction log. A badge revocation alert flashes on a secondary screen, instantly cascading to freeze all associated VST activity.